hxxps://igbconline[.]org/wp-content/uploads/2023/05/Bear-Smart-Manual-Final-Draft-16May23[.]pdf

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://igbconline.org/wp-content/uploads/2023/05/Bear-Smart-Manual-Final-Draft-16May23.pdf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409052446494242"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4824	4716	chrome.exe	85
PID 4716 wrote to memory of 4824	4716	chrome.exe	85
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 1432	4716	chrome.exe	88
PID 4716 wrote to memory of 5060	4716	chrome.exe	87
PID 4716 wrote to memory of 5060	4716	chrome.exe	87
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89
PID 4716 wrote to memory of 3424	4716	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://igbconline.org/wp-content/uploads/2023/05/Bear-Smart-Manual-Final-Draft-16May23.pdf
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa44169758,0x7ffa44169768,0x7ffa44169778
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3916 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 --field-trial-handle=1872,i,3112508192185586022,482502526413144505,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
489a9e605f2cb1997b5ff1a1778a916b

SHA1
9e104ccd60d2a4e76716f8172911506bb04918ce

SHA256
30cd201dfaee1ba3c831f592a9add89caed1c6c2a755f565b2db6bd59176349d

SHA512
0715aa36dbccf66550bb0ba553bfbc11462ff92fdc832346a2746ac23431a095715aedcd3bd6a642986a056e13f5a13f5be84ca1111721106fd3b4bec3d53d40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
53dfc103f5c92aef3003cfe81f8e22da

SHA1
bb60a85454fadc98ba691cec07633e4d258e8f45

SHA256
75a85ad0692bccc0f6e77e759fcd9c03065b9294dc6c8ed3f3558ec128e57fee

SHA512
1326ce97e78fa4a0a79df674198f797d692d88b9614cff92376914e660a6c05040a8806e3960b6ff5d0919a901c63b393d0c2b727e6a385b25491340c6d5e840

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cb80603537eae504b038b3ffd4825cec

SHA1
6ca7e1df80b902767c445bda103ef6b1c5672a0e

SHA256
a93f3795a85061af8c752964ff5057963159472da198a12ae835cf0d2edb8a98

SHA512
aac1acf39ac3f89115327a61f5e7398761ead951441eec94d3282767ea863defcb17213fa7ed0855ede277e9e7c113888f2c4cfb410f571e0728e6f3bca89c0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e113982729ed4b93b4983f49d83e6887

SHA1
f002aa594868bcce023d5dee4e5b762323ac0e62

SHA256
4a0af0a8a378866763f55c58585b0bb354273a5a5bcb6213426df4bd511e1300

SHA512
01521f0b58763d770556f83d32b8710c0f5751fa60303b0e11fec66eea1e754079e1520eb919c61f4a698c6ea0b0719138d352431b5eb6a92ca0ac24e79d7013

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
a14cf2c4bc49844a1b04fe33b95781d0

SHA1
be260d930a4765431c272e1a87984c21b6ac5ee7

SHA256
07dca6c15916108a95da1b5cf5e55b8f430c427166a0da9d50294311ec40ab9b

SHA512
7d7614e91ad36254cb406821fedbe564f8b96f4dfa4f705986cac01044e5363bc4e1150279468f01209da5f0e9f41fe34b50a919d5ade264980abfa174f23c8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit